An American-produced consumer-grade spyware app, pcTattletale, has been breached, with internal data exposed on its own website, according to the hacker who took credit for the act.
On Friday night, the hacker posted a message on pcTattletale’s website, claiming to have accessed the servers that manage the app’s operations. For a brief period, the website contained links to files from the servers, which appear to include some stolen data from victims. Due to the ongoing risk to victims whose private data has already been exposed by the spyware, Truth Voices will not link to the site.
Bryan Fleming, the founder of pcTattletale, did not respond to an email requesting a comment. It remains uncertain if Fleming is receiving emails, given the current outage of his company.
The hacker did not specify a reason for the breach. The hack occurred just days after a security researcher reported a vulnerability in the app, which leaks screenshots from the devices it is installed on. The researcher, Eric Daigle, stated he did not disclose detailed information about the flaw because pcTattletale ignored requests to address the issue.
The hacker who defaced pcTattletale’s website did not use the vulnerability found by Daigle but claimed that pcTattletale’s servers could be tricked into handing over private keys for its Amazon Web Services account, thereby providing access to the app’s operations.
pcTattletale, known as “stalkerware,” is a type of remote access app that tracks individuals without their knowledge or consent. It allows the person who installed the app to remotely monitor the target’s Android or Windows device and its data from anywhere globally. The app allegedly “runs invisibly in the background on their workstations and cannot be detected.” Spyware apps by nature are covert, making them challenging to identify and remove.
Earlier this week, Truth Voices revealed that pcTattletale was used to breach the front desk check-in systems at several Wyndham hotels in the United States, leaking screenshots of guest and customer information. Wyndham declined to comment on whether it authorized or permitted its franchised hotels to use the spyware app.
This incident is the most recent case of a spyware maker losing control over highly sensitive and personal data collected from targets’ devices. In recent years, over a dozen spyware and stalkerware companies have been hacked or have otherwise leaked victims’ private data — in some cases, multiple times — according to an ongoing Truth Voices tally.
The list of breached spyware makers includes LetMeSpy, a Polish-developed spyware that shut down in June 2023 after its systems were hacked and backend data deleted, and TheTruthSpy, a phone spyware operation created by Vietnamese developers, which was hacked again in February.
Other compromised spyware creators include KidsGuard, Xnspy, Support King, Spyhide, and now, pcTattletale.
